// @vitest-environment jsdom

import { describe, expect, it } from "vitest";
import { toHtml } from "./NoteEditor";

describe("toHtml sanitization (M15/THREAT-006)", () => {
  // Plain text path — escape special chars when no tag-like content present.
  it("escapes plain text ampersand", () => {
    expect(toHtml("a & b")).toBe("a & b");
  });

  it("converts newlines to <br> in plain text", () => {
    expect(toHtml("line1\nline2")).toBe("line1<br>line2");
  });

  // Strips disallowed tags by replacing with their textContent.
  it("strips iframe", () => {
    expect(toHtml('<iframe src="x">payload</iframe>')).not.toContain("iframe");
  });

  it("strips base", () => {
    expect(toHtml('<base href="//evil">')).not.toContain("base");
  });

  it("strips meta refresh", () => {
    expect(toHtml('<meta http-equiv="refresh" content="0;url=//evil">')).not.toContain("meta");
  });

  it("strips form", () => {
    expect(toHtml('<form action="x"><input name="y"></form>')).not.toContain("form");
  });

  it("strips script", () => {
    expect(toHtml('<script>alert(1)</script>')).not.toContain("script");
  });

  it("strips style", () => {
    expect(toHtml('<style>body{display:none}</style>')).not.toContain("style");
  });

  it("strips object/embed", () => {
    expect(toHtml('<object data="x"></object>')).not.toContain("object");
    expect(toHtml('<embed src="x">')).not.toContain("embed");
  });

  it("strips all attributes from allowed tags", () => {
    const result = toHtml('<b onclick="alert(1)" id="x" style="color:red">bold</b>');
    expect(result).toContain("<b>bold</b>");
    expect(result).not.toContain("onclick");
    expect(result).not.toContain("style");
    expect(result).not.toContain("id=");
  });

  it("strips href from a tags (a is not in allow-list)", () => {
    const result = toHtml('<a href="//evil.com">click</a>');
    expect(result).not.toContain("href");
    expect(result).not.toContain("<a");
  });

  // Preserve allow-listed tags.
  it("preserves bold", () => {
    expect(toHtml("<b>hi</b>")).toContain("<b>hi</b>");
  });

  it("preserves italic, underline, strikethrough", () => {
    expect(toHtml("<i>x</i><u>y</u><s>z</s>")).toContain("<i>x</i><u>y</u><s>z</s>");
  });

  it("preserves strong and em", () => {
    expect(toHtml("<strong>x</strong><em>y</em>")).toContain("<strong>x</strong><em>y</em>");
  });

  it("preserves headings h2 and h3", () => {
    expect(toHtml("<h2>x</h2><h3>y</h3>")).toContain("<h2>x</h2><h3>y</h3>");
  });

  it("preserves lists", () => {
    const result = toHtml("<ul><li>a</li><li>b</li></ul>");
    expect(result).toContain("<ul>");
    expect(result).toContain("<li>a</li>");
  });

  it("preserves br, hr, p", () => {
    expect(toHtml("<p>x<br>y</p><hr>")).toContain("<p>");
    expect(toHtml("<p>x<br>y</p><hr>")).toContain("<br>");
    expect(toHtml("<p>x<br>y</p><hr>")).toContain("<hr>");
  });

  // Nested adversarial cases.
  it("strips script nested inside allowed tag", () => {
    expect(toHtml("<b><script>alert(1)</script></b>")).not.toContain("script");
  });

  it("strips javascript: URL by removing the href attribute from a-tag (a not allowed)", () => {
    const result = toHtml('<a href="javascript:alert(1)">x</a>');
    expect(result).not.toContain("javascript:");
    expect(result).not.toContain("href");
  });

  it("strips img with onerror", () => {
    const result = toHtml('<img src="x" onerror="alert(1)">');
    expect(result).not.toContain("img");
    expect(result).not.toContain("onerror");
  });

  it("strips svg", () => {
    expect(toHtml('<svg><script>alert(1)</script></svg>')).not.toContain("svg");
  });
});